- Remove ReadWritePaths sandbox (causes namespace error when /run/nostr-vpn doesn't exist after reboot — /run is tmpfs) - Detect both 'active' and 'activating' states in VPN status check Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>